# AATS governance — public draft policy

## Phases

- **v0.9:** ColomboAI edits the public working draft, publishes issues, decisions, and a changelog. This is not yet an independent standards body.
- **v1.0:** AATS Founding Coalition / Working Group reviews normative controls, interoperability, evaluator independence, and public objections. Participation does not imply endorsement.
- **v1.x+:** A published contributor and technical steering process selects maintainers through transparent criteria; any proposed independent foundation requires an actual legal and governance decision.

## RFC process

An RFC identifies the problem, proposed normative text, affected control IDs/schemas, migration effect, security/privacy impact, test procedure, alternatives, and conflicts of interest. Editors publish an issue and review window; substantive objections receive a written resolution. A technical steering group records votes, recusals, and dissent. Emergency security fixes may be expedited but must receive retrospective public review. Stable control IDs are never silently repurposed.

## Versioning and compatibility

Patch versions clarify wording without changing obligations. Minor versions add compatible optional fields or controls. Major versions may change normative obligations or schema compatibility. Every release has a public changelog and machine-readable schema version. Certificates name the exact assessed standard version; an upgrade requires a documented delta assessment. Draft v0.9 cannot be represented as globally ratified.

## Independence and conflicts

An evaluator must disclose financial, implementation, ownership, and advisory relationships with the applicant or certification infrastructure. A conflicted evaluator cannot make the independent certification decision for that scope. ColomboAI employees may develop AATS and MC-1 tooling but cannot act as the independent assessor of their own deployment. Appeals and complaints go to a separate review group with conflicted members recused. Assessment methodology, qualification criteria, and revocation rules must be public before claims of an authorized evaluator program are made.

## Open participation and intellectual property

Contributions are submitted under the repository license with confirmation that the contributor can grant those rights. Implementers need no MC-1 account or service to use AATS. Specification conformance cannot require proprietary extensions. Any proposed patent-encumbered requirement needs public disclosure and explicit review before adoption.